By Readonly


2008-09-07 06:26:12 8 Comments

How can you find out which process is listening on a port on Windows?

26 comments

@Talha Imam 2018-12-14 06:55:15

To find out which specific process(PID) is using which port:

netstat -anon | findstr 1234

Where 1234 is the PID of your process. [Go to Task Manager -> Services/Processes tab to find out the PID of your application]

@Brad Wilson 2008-09-07 06:28:33

powershell

Get-Process -Id (Get-NetTCPConnection -LocalPort portNumber).OwningProcess

cmd

 C:\> netstat -a -b

(add -n to stop it trying to resolve hostnames, which will make it a lot faster)

Note Dane's recommendation for TCPView. Looks very useful!

-a Displays all connections and listening ports.

-b Displays the executable involved in creating each connection or listening port. In some cases well-known executables host multiple independent components, and in these cases the sequence of components involved in creating the connection or listening port is displayed. In this case the executable name is in [] at the bottom, on top is the component it called, and so forth until TCP/IP was reached. Note that this option can be time-consuming and will fail unless you have sufficient permissions.

-n Displays addresses and port numbers in numerical form.

-o Displays the owning process ID associated with each connection.

@Laurent K 2012-07-10 08:03:22

-o to get the PID

@BitMask777 2013-03-04 20:03:28

and taskkill /PID <pid> to then terminate the process, using /F if appropriate.

@Gruber 2014-07-29 11:20:56

You may have to run your command line shell as administrator, otherwise you may get an error message about insufficient privileges. Use the "Run as administrator" option when right-clicking cmd.exe.

@Pacerier 2015-05-05 00:20:15

@BradWilson, How do you show the "Firewall Status" as resmon (bcorso's answer) does?

@Christian Bongiorno 2015-06-18 20:53:32

Works but requires elevated permission. Shift+right click on command icon -> run as administrator

@qwertzguy 2015-11-21 19:37:59

When using -o to show PID, you can then pipe it to grep for the port number (if cygwin or msys installed) as the pid is shown on the same line as opposed to the process name which is shown on a separate line.

@sebastian_t 2016-06-15 12:11:40

Sometimes I can't run my Apache httpd server because PID 4 is taking port 80 for some reason. Problem is the process with PID 4 is well The "System". Restart helps but if anyone knows the reason or a way to find out why System is taking port 80 I'm all ears.

@aaaaaa 2016-12-15 17:35:01

The GUI does not need privileges whereas this command does.

@Sathish 2017-03-08 12:07:39

@BradWilson "-b" is an invalid option please use netstat -a -d

@Seth 2017-05-19 17:25:43

@BradWilson and @Sathish It appears netstat's options are not that standard. I had to use netstat -a -n -p. The -b and -d options are not available. The -o option was for timers. The -p options displayed the program name and PID. (on debian 8).

@paradox 2017-05-25 22:16:27

netstat 1.42 (2001-04-15) has no flag -b

@Steve Chambers 2017-11-28 10:32:52

Having got the PID - let's say it's 1234 - then you can use tasklist /fi "pid eq 1234" to find out the name and other details of the process.

@Lqueryvg 2018-04-22 10:01:19

What a shame that the output is split over two lines.

@CarLuva 2018-05-06 02:51:13

On my system, the output from this command, besides being horribly difficult to read due to wrapping, overflowed the command prompt's buffer. I normally prefer command-line tools (although I'm admittedly much more comfortable in a Linux command line than Windows), but in this case, I found the Resource Monitor GUI suggested by @bcorso much more useful.

@Tereza Tomcova 2018-08-02 15:04:40

@sebastian_t For the System process (PID 4) there's netsh http show urlacl. It shows system URL reservations.

@sebastian_t 2018-08-02 21:52:43

@TerezaTomcova Wait... does that mean Windows has some kind of HTTP API ?

@Nabi K.A.Z. 2018-08-03 18:08:17

use | grep :80 is useful for search for specific port. if installed grep.

@Talha Imam 2018-12-14 07:01:44

netstat -a -b overflowed the whole cmd screen. I couldn't find the pid i was looking for before it went away. What i needed was a way to find the port of a specific process using pid.

@Michael 2018-11-05 18:16:10

Programmatically, you need stuff from iphlpapi.h, for example GetTcpTable2(). Structures like MIB_TCP6ROW2 contain the owner PID.

@Richard Walters 2018-11-16 06:37:02

Thank you, I was looking for the programmatic way!

@Blue Clouds 2018-09-23 05:05:33

Netstat -a displays all connection and listening ports -b displays executables -n stop resolve hostnames (numerical form) -o owning process

netstat -bano | findstr "7002"

netstat -ano > ano.txt 

Currports helps to search and filter

@Ram Sharma 2018-01-24 03:50:42

The -b switch mentioned in most answers requires you to have administrative privileges on the machine. You don't really need elevated rights to get the process name!

Find the pid of the process running in the port number (e.g., 8080)

netstat -ano | findStr "8080"

Find the process name by pid

tasklist /fi "pid eq 2216"

find process by TCP/IP port

@deshapriya debesh 2018-05-04 18:15:53

Use below batch script which takes a process name as argument and gives netstat output for the process.

@echo off
set procName=%1
for /f "tokens=2 delims=," %%F in ('tasklist /nh /fi "imagename eq %1" /fo csv') do call :Foo %%~F
goto End

:Foo
set z=%1
echo netstat for : "%procName%" which had pid "%1"
echo ----------------------------------------------------------------------

netstat -ano |findstr %z%
goto :eof

:End

@Jpsy 2017-12-28 09:06:54

Using Powershell...
...this would be your friend (replace 8080 with your port number):

 netstat -abno | Select-String -Context 0,1 -Pattern 8080

Sample output

>   TCP    0.0.0.0:8080           0.0.0.0:0              LISTENING         2920
   [tnslsnr.exe]
>   TCP    [::]:8080              [::]:0                 LISTENING         2920
   [tnslsnr.exe]

So in this example tnslsnr.exe (OracleXE database) is listening on port 8080.

Quick explanation
Select-String is used to filter the lengthy output of netstat for the relevant lines.
-Pattern tests each line against a regular expression.
-Context 0,1 will output 0 leading lines and 1 trailing line for each pattern match.

@Josh 2015-06-29 22:07:20

I recommend CurrPorts from NirSoft.

CurrPorts can filter the displayed results. TCPView doesn't have this feature.

Note: You can right click a process's socket connection and select "Close Selected TCP Connections" (You can also do this in TCPView). This often fixes connectivity issues I have with Outlook and Lync after I switch VPNs. With CurrPorts, you can also close connections from the command line with the "/close" parameter.

@wmac 2016-01-04 16:01:52

Wow, this is excellent. I was struggling with resmon (taking the pid and using it in Taskman to find the path to the executable).

@Cyborg 2012-11-08 01:49:31

  1. Open a command prompt window (as Administrator) From "Start\Search box" Enter "cmd" then right-click on "cmd.exe" and select "Run as Administrator"

  2. Enter the following text then hit Enter.

    netstat -abno

    -a Displays all connections and listening ports.

    -b Displays the executable involved in creating each connection or listening port. In some cases well-known executables host multiple independent components, and in these cases the sequence of components involved in creating the connection or listening port is displayed. In this case the executable name is in [] at the bottom, on top is the component it called, and so forth until TCP/IP was reached. Note that this option can be time-consuming and will fail unless you have sufficient permissions.

    -n Displays addresses and port numbers in numerical form.

    -o Displays the owning process ID associated with each connection.

  3. Find the Port that you are listening on under "Local Address"

  4. Look at the process name directly under that.

NOTE: To find the process under Task Manager

  1. Note the PID (process identifier) next to the port you are looking at.

  2. Open Windows Task Manager.

  3. Select the Processes tab.

  4. Look for the PID you noted when you did the netstat in step 1.

    • If you don’t see a PID column, click on View / Select Columns. Select PID.

    • Make sure “Show processes from all users” is selected.

@bcorso 2014-05-18 05:02:54

There's a native GUI for Windows:

  • Start>>All Programs>>Accessories>>System Tools>>Resource Monitor

or Run resmon.exe, or from TaskManager performance tab

enter image description here

@Raphael 2014-07-02 17:34:04

Also shows the binding's firewall status (last column). Very util.

@Pacerier 2015-05-05 00:20:58

@data, The only problem is that the UI for this program is seriously horrible.

@KrishPrabakar 2016-01-04 07:40:54

You need to be an administrator (or in that group) to run this.

@Pacerier 2016-01-22 14:36:10

@bcorso, What does binding to "unspecified address" mean?

@Nishat Lakhani 2016-05-30 06:23:24

It is not showing port number respective to PID.

@Mathieu K. 2016-10-09 13:55:39

Can also be launched from Task Manager's Performance tab, at least in Windows 10. (Have not checked other versions.)

@RBT 2017-04-24 07:31:53

You can also start resource monitor from performance tab of Task Manager by clicking the Open Resource Monitor button. From run prompt perfmon /res command also works to open resource monitor.

@zhaorufei 2017-07-26 13:23:19

I use windows 7 with SP1, it already has resource monitor.

@Jpsy 2017-12-28 09:27:22

The comment of @user4836454 above is NOT correct: Resource Monitor DOES show ports with listeners, even if there is no network connection to these ports. Just look into the section "Listening Ports" instead of the section "TCP Connections".

@Panzercrisis 2018-02-26 13:54:47

This seems to omit some of the TCP ports that are getting used sometimes, even if they're used to the extent that other applications that need them can't start.

@Tristan van Dam 2018-03-05 06:30:12

Definitely prefer the GUI interface to using netstat as it's a lot easier to find a port in particular that you are looking for. Thanks for this +1

@Talha Imam 2018-12-14 07:03:47

For some reason, the pid i was looking for was not listed in the resource monitor. Had to run the netstat command eventually.

@Monis Majeed 2014-04-17 14:38:27

To get a list of all the owning process ID associated with each connection:

netstat -ao |find /i "listening"

If want to kill any process have the id and use this command, so that port become free

Taskkill /F /IM pidof a process

@evandrix 2018-12-02 20:30:36

this doesn't account for listening UDP ports

@Pankaj Pateriya 2014-08-23 15:25:04

First we find process id of that particular task which we need to eliminate in order to get port free

type
netstat -n -a -o

After executing this command in windows command line prompt(cmd) select the pid which i think the last column suppose this is 3312

Now type

taskkill /F /PID 3312

You can now cross check by typing netstat command.

NOTE: sometimes windows doesn`t allow you to run this command directly on CMD so first you need to go with this steps from start-> command prompt (right click on command prompt, and run as administrator)

@Tajveer Singh Nijjar 2017-01-25 00:13:23

Just open a command shell and type : (saying your port is 123456)

netstat -a -n -o | find "123456"

You will see everything you need

The headers are :

 Proto  Local Address          Foreign Address        State           PID
 TCP    0.0.0.0:37             0.0.0.0:0              LISTENING       1111

this is as mentioned here

@Josh 2017-07-10 22:52:17

"findstr" (not "find") works for me

@Kevin Cruijssen 2018-06-13 15:05:18

FYI/for anyone interested: It's either findstr 123456 (without quotes) or find "123456" (with quotes). (@Josh)

@Zoomzoom 2017-01-24 21:10:18

For Windows, if you want to find stuff listening or connected to port 1234, execute the following at the cmd prompt:

netstat -na | find "1234"

@Technotronic 2016-11-22 15:36:53

Type in the command: netstat -aon | findstr :DESIRED_PORT_NUMBER

For example, if I want to find port 80: netstat -aon | findstr :80

This answer was originally posted in this thread.

@mikemaccana 2016-08-25 13:36:42

For those using Powershell, try Get-NetworkStatistics:

> Get-NetworkStatistics | where Localport -eq 8000


ComputerName  : DESKTOP-JL59SC6
Protocol      : TCP
LocalAddress  : 0.0.0.0
LocalPort     : 8000
RemoteAddress : 0.0.0.0
RemotePort    : 0
State         : LISTENING
ProcessName   : node
PID           : 11552

@bahrep 2016-11-02 19:19:44

With PowerShell 5 on Windows 10 or Windows Server 2016, run Get-NetTCPConnection cmdlet. I guess that it should also work on older Windows versions.

The default output of Get-NetTCPConnection does not include Process ID by some reason and it is a bit confusing. However, you could always get it by formatting the output. The property you are looking for is OwningProcess.

  • If you want to find out the ID of the process that is listening on port 443, run this command:

    PS C:\> Get-NetTCPConnection -LocalPort 443 | Format-List
    
    LocalAddress   : ::
    LocalPort      : 443
    RemoteAddress  : ::
    RemotePort     : 0
    State          : Listen
    AppliedSetting :
    OwningProcess  : 4572
    CreationTime   : 02.11.2016 21:55:43
    OffloadState   : InHost
    
  • Format the output to a table with the properties you look for:

    PS C:\> Get-NetTCPConnection -LocalPort 443 | Format-Table -Property LocalAddress, LocalPort, State, OwningProcess
    
    LocalAddress LocalPort  State OwningProcess
    ------------ ---------  ----- -------------
    ::                 443 Listen          4572
    0.0.0.0            443 Listen          4572
    
  • If you want to find out a name of the process, run this command:

    PS C:\> Get-Process -Id (Get-NetTCPConnection -LocalPort 443).OwningProcess
    
    Handles  NPM(K)    PM(K)      WS(K)     CPU(s)     Id  SI ProcessName
    -------  ------    -----      -----     ------     --  -- -----------
    143      15     3448      11024              4572   0 VisualSVNServer
    

@Nishat Lakhani 2016-05-30 06:36:12

It is very simple to get the port number from pid in windows.

The following are the steps:

1) Go to run --> type cmd --> press enter.

2) write the following command...

netstat -aon | findstr [port number]

(Note: Don't include square brackets.)

3) press enter...

4) Then cmd will give you the detail of the service running on that port alongwith pid.

5) Open task manager and hit the service tab and match the pid with that of the cmd and that's it.

@ROMANIA_engineer 2016-02-10 10:17:05

Get PID and Image Name

Use only one command:

for /f "tokens=5" %a in ('netstat -aon ^| findstr 9000') do tasklist /FI "PID eq %a"

where 9000 should be replaced by your port number.

The output will contain something like this:

Image Name                     PID Session Name        Session#    Mem Usage
========================= ======== ================ =========== ============
java.exe                      5312 Services                   0    130,768 K

Explanation:

  • it iterates through every line from the output of the following command:

    netstat -aon | findstr 9000
    
  • from every line, the PID (%a - the name is not important here) is extracted (PID is the 5th element in that line) and passed to the following command

    tasklist /FI "PID eq 5312"
    

If you want to skip the header and the return of the command prompt, you can use:

echo off & (for /f "tokens=5" %a in ('netstat -aon ^| findstr 9000') do tasklist /NH /FI "PID eq %a") & echo on

Output:

java.exe                      5312 Services                   0    130,768 K

@Koshera 2016-04-21 20:35:22

Agreed! This is the only answer that filters by the port and does not require elevated privileges on your machine. Best answer!

@Tayab Hussain 2018-01-08 08:02:44

Really helpful solution

@Tony Delroy 2014-03-13 19:57:41

netstat -ao and netstat -ab tell you the application, but if you're not admin you'll get "The requested operation requires elevation".

It's not ideal, but if you use sysinternals Process Explorer you can go to specific processes' properties and look at the TCP tab to see if they're using the port you're interested in. Bit of a needle and haystack thing, but maybe it'll help someone....

@Abel 2017-01-25 11:52:44

If you're not an admin you won't be able to use Process Explorer (or even Windows Task Manager > Resource Manager) to get this info from any process that is not yours to begin with.

@Ventzy Kunev 2017-08-16 05:02:33

Thanks for Process Explorer tip. Too bad I don't see option to app ports to column in processes list view.

@Nathan24 2013-10-08 18:56:07

You can get more information if you run the following command:

netstat -aon |find /i "listening" |find "port"

using the 'Find' command allows you to filter the results. find /i "listening" will display only ports that are 'Listening'. Note, you need the /i to ignore Case otherwise you would type find "LISTENING". |find "port" will limit the results to only those containing the specific port number. Note, on this it will also filter in results that have the port number anywhere in the response string.

@self. 2015-08-25 13:16:57

FWIW attempting to run this in PowerShell v2.0 yields error FIND: Parameter format not correct. You need to add a space after the find criteria. This will leave you with netstat -aon | find /i "listening" | find "1234 ".

@joey 2017-06-17 23:58:33

Replace "port" above with your port, ex "5000"

@Nicke Manarin 2017-12-22 18:11:12

@self. I still get that error with PS 5.1, even after adding the space after the pipe. Do you know what's happening?

@Tristan van Dam 2018-03-05 06:37:06

@NickeManarinin & @self either first change from powershell to cmd (just type cmd and press enter then redo the command) or in powershell use this command instead: netstat -aon |find /i "{back tick}"listening{back tick}"" |find "{back tick}"port{back tick}"" (<- note the escaped quotes - excuse the term back tick as i cannot add the actual character as it thinks its a snipping)

@nisha 2013-08-13 02:32:08

netstat -a -o This shows the PID of the process running on a particular port.

Keep in mind the process id and go to Task manager and services or details tab and end the process which has the same PID.

Thus you can kill a process running on a particular port in windows.

@Perl Fanatic 2013-08-11 18:39:52

Follow these tools :- From cmd :- C:\> netstat -anob with Administrator privilege.

http://technet.microsoft.com/en-us/sysinternals/bb896653 - Process Explorer

http://technet.microsoft.com/en-us/sysinternals/bb896645 - Process Dump

http://technet.microsoft.com/en-us/sysinternals/bb896644 - Port Monitor

All from sysinternals.com

If you just want to know process running and threads under each process, I recommend to learn about wmic. Wonderful cmd line tool, which gives you much more than you can know.

Exampe :-

c:\> wmic process list brief /every:5

Above command will show all process list in brief every 5 seconds. To know more, you can just go with /? command of windows , for E.g,

c:\>wmic /?
c:\>wmic process /?
c:\>wmic prcess list /?

and so on and so forth. :)

@Dave Webb 2008-09-07 06:40:26

If you'd like to use a GUI tool to do this there's SysInternals TCPView.

@Dane 2008-09-07 06:38:37

Use TCPView if you want a GUI for this. It's the old Sysinternals app that Microsoft bought out.

@Andreas Lundgren 2016-01-18 08:23:50

This is according to me the best option, especially since all processes are in the same list and you can close processes directly by right-clicking them.

@Janac Meena 2018-02-09 18:34:00

Also, this doesn't require admin privelges!

@SpeedOfRound 2018-09-07 19:31:49

Exactly what I needed, the command shell was not convenient for a large amount of results.

@aku 2008-09-07 06:32:10

netstat -aon | find /i "listening"

@J c 2008-10-14 14:56:51

I just tried this and it doesn't show any process info.

@aku 2008-10-15 04:04:43

"doesn't show any process info" huh? it shows process ids of all listening processes. If you need name of process, use Brad's solution

@J c 2008-10-17 12:01:11

My bad, didn't see the PID as I was looking for the process name.

@Moby04 2014-05-05 09:15:26

@aku: could you please take a look at stackoverflow.com/questions/23468107/…

@Levit 2014-06-30 10:29:58

+1 But keep in mind, if your windows runs in a language other than english, you will have to change "listening" to the native term. E.g. netstat -aon | find /i "abhören" for german.

@The Godfather 2015-11-17 16:07:11

In my case it didn't work maybe because of quotes sign, but the solution netstat -aon | findstr LISTENING works perfectly!

@Vlad Schnakovszki 2017-10-02 16:02:42

This works without requiring elevated privileges so upvoted.

@Nicke Manarin 2017-12-22 18:05:31

I'm getting an error while trying to run this command on W10 15063.729 with PowerShell: FIND: Parameter format not correct

Related Questions

Sponsored Content

22 Answered Questions

[SOLVED] Is there an equivalent of 'which' on the Windows command line?

45 Answered Questions

[SOLVED] How can I develop for iPhone using a Windows development machine?

  • 2008-08-22 13:35:01
  • ryan
  • 1079543 View
  • 1110 Score
  • 45 Answer
  • Tags:   ios windows macos

10 Answered Questions

[SOLVED] How to kill the process currently using a port on localhost in windows?

17 Answered Questions

[SOLVED] How to kill a process running on particular port in Linux?

14 Answered Questions

[SOLVED] How to find an available port?

32 Answered Questions

[SOLVED] How can I set up an editor to work with Git on Windows?

18 Answered Questions

[SOLVED] How can you echo a newline in batch files?

16 Answered Questions

[SOLVED] Can two applications listen to the same port?

6 Answered Questions

[SOLVED] How to find which program is using port 80 in Windows?

  • 2009-12-25 08:05:28
  • user198729
  • 471431 View
  • 155 Score
  • 6 Answer
  • Tags:   windows port

5 Answered Questions

[SOLVED] Process listening which Port on Windows

Sponsored Content